From ee323ec8c473f30e3a6a5b5c5834a1fcfea86d9f Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:29:17 -0700 Subject: Drop auth guards for input cgit never sends cgit names no repository with an empty string, never nil, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie. --- tests/extensions/test-auth.lua | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 07c7341..77cc605 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -94,7 +94,6 @@ h.equals("an account is found whatever its case", hash, stored_hash) h.equals("an unknown account is not", account_hash("nobody"), nil) local _, stand_in = account_hash("nobody") h.equals("it brings another account's hash to spend instead", stand_in, stored_hash) -h.equals("a nil user is not", account_hash(nil), nil) local userset = repo_userset("secret-repo") h.check("a protected repository lists its users", @@ -113,12 +112,14 @@ if variant == "file" then h.equals("a missing users file turns every login down", account_hash("alice"), nil) h.redirect_file("/etc/cgit-auth/users", "auth-users") -- Without the repos file nothing tells a protected repository from a - -- public one, so every repository is refused while the index stays up. + -- public one, so every page is refused, the index too, which cgit asks + -- about with an empty repository name. h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing") local refused = repo_userset("unlisted") h.check("a missing repos file refuses every repository", refused ~= nil and next(refused) == nil) - h.equals("the index stays public all the same", repo_userset(nil), nil) + local index = repo_userset("") + h.check("and the index as well", index ~= nil and next(index) == nil) h.redirect_file("/etc/cgit-auth/repos", "auth-repos") end -- cgit